2012 R2 environment

When a server is created to be a domain controller, it can be setup using the domain\administrator account when is attached to the domain. The machine will also have the default machine administrator account.

Are there fundamental reasons why the domain controller server should have other user accounts setup?

  • 2
    IIRC, domain controllers don't have local users - they only have users created within AD. – EEAA Jun 12 '15 at 3:23
  • The answer is in fact below, but since comments following might confuse I thought I would add that EEAA did recall correctly. The comments following the answer below simply reflect my learning curve & since I was unclear at 1st, I thought I would add for others like me that the comment above is precisely correct. This link also expresses the same answer with slightly different wording. – Alan Jul 7 '15 at 16:32

Once a server is promoted to a DC (i.e the DC role is installed), the "default" administrator account you mention no longer exists. The Administrator account now exists in the domain. Any account created on the DC from now on will exist only on the domain. The DC no longer has the concept of "Local Users".

The fundamental reason that a DC should have other standard user accounts set up is because you don't want your users to be using the administrator account, and you want each user to have their own identity.

Consider creating your own standard user account, and only use the administrator account when absolutely needed.

Also worth a mention, Best practice is to rename the administrator account

| improve this answer | |
  • Nice explanation of the rationale vis a vis a DC, thanks. While the idea of user identities seems obvious, it's always helpful to restate the obvious. Any thoughts on user accounts for other non-DC servers such as a TFS or IIS or SharePoint server vis a vis this idea of individual identiies, or does the same rationale apply there as well? Thanks for link on renaming the admin account. I had read about that technique as well but not seen the TechNet page. – Alan Jun 12 '15 at 15:38
  • Cheers Alan. Um - IIS related stuff is a whole another subject - IIS runs as special users that it auto creates, in most circumstances. They get created in the domain. Honestly though, I'm not the guy to ask. – Patrick Jun 16 '15 at 5:10
  • As I've been thinking about this and re-reading it, I'd like to ask for clarification. You stated when the server is promoted to DC, the default administrator no longer exists. But then you said we need standard accounts. Does this mean you can have other accounts on the server that is a DC, it's just that there can only be one administrator account? – Alan Jul 1 '15 at 23:33
  • Alan you are at risk of getting LMGTFY answers - I noticed with your other questions that you may need to just do some of your own tinkering/breaking/fixing/stuffing around in a test environemnt. You are comparing my staement "the default administrator no longer exists" with your statement "But then you said we need standard accounts" Honestly, this doesn't make any sense, you may be missing some kind of fundamental understanding. Just play around with it, hands on is the best learning. Grab a client PC and joining it to the domain and experiment with it too. – Patrick Jul 2 '15 at 3:49
  • (Yes, you can have 10 thousand accounts if you like. Yes you can have more than one administrator. No, they would not all be called 'administrator') – Patrick Jul 2 '15 at 3:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.